265 lines
18 KiB
JavaScript
265 lines
18 KiB
JavaScript
'use strict';
|
|
|
|
const crypto = require('node:crypto');
|
|
const net = require('node:net');
|
|
|
|
const REALITY_PRESETS = Object.freeze([
|
|
{ id: 'tesla', label: 'Tesla', serverName: 'www.tesla.com', destPort: 443 },
|
|
{ id: 'amazon', label: 'Amazon', serverName: 'www.amazon.com', destPort: 443 },
|
|
{ id: 'apple', label: 'Apple', serverName: 'www.apple.com', destPort: 443 },
|
|
{ id: 'intel', label: 'Intel', serverName: 'www.intel.com', destPort: 443 },
|
|
{ id: 'amd', label: 'AMD', serverName: 'www.amd.com', destPort: 443 }
|
|
]);
|
|
|
|
const PROFILE_CATALOG = Object.freeze([
|
|
{ id: 'vless-reality-vision', role: 'relay-ingress', name: 'VLESS · Reality · Vision', status: 'stable', deployable: true, capabilities: ['reality'], description: '推荐公网入口，无需在节点机部署证书。' },
|
|
{ id: 'vless-reality', role: 'relay-ingress', name: 'VLESS · Reality', status: 'stable', deployable: true, capabilities: ['reality'], description: '不启用 Vision 流控的 Reality 入口。' },
|
|
{ id: 'vless-ws', role: 'relay-ingress', name: 'VLESS · WebSocket', status: 'beta', deployable: true, capabilities: ['websocket'], description: '无 TLS 的兼容模式，建议仅在可信或外层 TLS 环境使用。' },
|
|
{ id: 'vmess-ws', role: 'relay-ingress', name: 'VMess · WebSocket', status: 'beta', deployable: true, capabilities: ['websocket'], description: '兼容旧客户端，建议仅在外层 TLS 环境使用。' },
|
|
{ id: 'shadowsocks-2022-aes128', role: 'relay-ingress', name: 'SS 2022 · AES-128', status: 'stable', deployable: true, capabilities: [], description: '轻量、推荐的 AEAD 2022 入口。' },
|
|
{ id: 'shadowsocks-2022-aes256', role: 'relay-ingress', name: 'SS 2022 · AES-256', status: 'stable', deployable: true, capabilities: [], description: '32 字节密钥的 AEAD 2022 入口。' },
|
|
{ id: 'shadowsocks-aes128-gcm', role: 'relay-ingress', name: 'SS · AES-128-GCM', status: 'stable', deployable: true, capabilities: [], description: '兼容主流旧版 Shadowsocks 客户端。' },
|
|
{ id: 'shadowsocks-aes256-gcm', role: 'relay-ingress', name: 'SS · AES-256-GCM', status: 'stable', deployable: true, capabilities: [], description: '兼容主流旧版 Shadowsocks 客户端。' },
|
|
{ id: 'socks5-auth', role: 'relay-ingress', name: 'SOCKS5 · 用户密码', status: 'stable', deployable: true, capabilities: [], description: '适合受控网络或程序级代理。' },
|
|
{ id: 'vless-ws-tls', role: 'relay-ingress', name: 'VLESS · WS · TLS', status: 'beta', deployable: true, capabilities: ['tls-domain'], description: '需为每台入口设备填写 TLS 域名，并在 Agent 上安装对应证书。' },
|
|
{ id: 'hysteria2', role: 'relay-ingress', name: 'Hysteria 2 · UDP', status: 'beta', deployable: true, capabilities: ['udp', 'tls-domain'], description: '由新版 Xray 承载；入口须安装有效节点证书并放行所选 UDP 端口。' },
|
|
{ id: 'anytls', role: 'relay-ingress', name: 'AnyTLS · TLS', status: 'beta', deployable: true, capabilities: ['tls-domain', 'sing-box'], description: '由 sing-box 独立承载，需入口设备的有效节点证书；支持直连或转发到现有出口。' },
|
|
{ id: 'shadowsocks-2022-aes128', role: 'exit-transport', name: 'SS 2022 · AES-128', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '推荐的转发到出口传输。' },
|
|
{ id: 'shadowsocks-2022-aes256', role: 'exit-transport', name: 'SS 2022 · AES-256', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '增强密钥长度的转发传输。' },
|
|
{ id: 'shadowsocks-aes128-gcm', role: 'exit-transport', name: 'SS · AES-128-GCM', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '兼容旧环境的转发传输。' },
|
|
{ id: 'shadowsocks-aes256-gcm', role: 'exit-transport', name: 'SS · AES-256-GCM', status: 'stable', deployable: true, capabilities: ['encrypted'], description: '兼容旧环境的转发传输。' },
|
|
{ id: 'vless-tcp', role: 'exit-transport', name: 'VLESS · TCP', status: 'beta', deployable: true, capabilities: [], description: '适合可信内网或已有加密隧道，不建议裸露公网。' },
|
|
{ id: 'socks5-auth', role: 'exit-transport', name: 'SOCKS5 · 用户密码', status: 'beta', deployable: true, capabilities: [], description: '不加密，仅用于可信网络或外层隧道。' }
|
|
]);
|
|
|
|
const SHADOWSOCKS_METHODS = Object.freeze({
|
|
'shadowsocks-2022-aes128': { method: '2022-blake3-aes-128-gcm', keyBytes: 16 },
|
|
'shadowsocks-2022-aes256': { method: '2022-blake3-aes-256-gcm', keyBytes: 32 },
|
|
'shadowsocks-aes128-gcm': { method: 'aes-128-gcm', keyBytes: 24 },
|
|
'shadowsocks-aes256-gcm': { method: 'aes-256-gcm', keyBytes: 32 }
|
|
});
|
|
|
|
function b64(bytes) { return crypto.randomBytes(bytes).toString('base64'); }
|
|
function shortId() { return crypto.randomBytes(8).toString('hex'); }
|
|
|
|
function newCredentialSet(relayProtocol, exitProtocol) {
|
|
const relayCipher = SHADOWSOCKS_METHODS[relayProtocol];
|
|
const exitCipher = SHADOWSOCKS_METHODS[exitProtocol];
|
|
return {
|
|
clientId: crypto.randomUUID(),
|
|
relayPassword: b64(relayCipher ? relayCipher.keyBytes : 24),
|
|
exitPassword: b64(exitCipher ? exitCipher.keyBytes : 24),
|
|
socksUser: `ng_${crypto.randomBytes(5).toString('hex')}`,
|
|
shortId: shortId(),
|
|
wsPath: `/${crypto.randomBytes(8).toString('hex')}`
|
|
};
|
|
}
|
|
|
|
function listenAddress(networkMode) { return networkMode === 'ipv6' || networkMode === 'dual' ? '::' : '0.0.0.0'; }
|
|
|
|
function inboundBase(tag, port, protocol, settings, streamSettings, networkMode = 'ipv4') {
|
|
return {
|
|
tag, listen: listenAddress(networkMode), port, protocol, settings,
|
|
sniffing: { enabled: true, destOverride: ['http', 'tls', 'quic'], routeOnly: true },
|
|
...(streamSettings ? { streamSettings } : {})
|
|
};
|
|
}
|
|
|
|
function shadowsocksInbound(tag, port, protocol, password, networkMode) {
|
|
const cipher = SHADOWSOCKS_METHODS[protocol];
|
|
if (!cipher) return null;
|
|
return inboundBase(tag, port, 'shadowsocks', { method: cipher.method, password, network: 'tcp,udp' }, null, networkMode);
|
|
}
|
|
|
|
function socksInbound(tag, port, credentials, password, networkMode) {
|
|
return inboundBase(tag, port, 'socks', {
|
|
auth: 'password', accounts: [{ user: credentials.socksUser, pass: password }], udp: true, ip: '127.0.0.1', userLevel: 0
|
|
}, null, networkMode);
|
|
}
|
|
|
|
function buildExitResource({ resourceId, tagPrefix, port, protocol, credentials, customer, networkMode }) {
|
|
let inbound = shadowsocksInbound(`${tagPrefix}-in`, port, protocol, credentials.exitPassword, networkMode);
|
|
if (protocol === 'socks5-auth') inbound = socksInbound(`${tagPrefix}-in`, port, credentials, credentials.exitPassword, networkMode);
|
|
if (protocol === 'vless-tcp') {
|
|
inbound = inboundBase(`${tagPrefix}-in`, port, 'vless', {
|
|
clients: [{ id: credentials.clientId, email: `ng:${customer.id}` }], decryption: 'none'
|
|
}, { network: 'raw', security: 'none' }, networkMode);
|
|
}
|
|
if (!inbound) throw new Error(`Unsupported exit transport: ${protocol}`);
|
|
const directTag = `${tagPrefix}-direct`;
|
|
return {
|
|
id: resourceId, meta: { kind: 'exit', customerId: customer.id, metricsTag: inbound.tag }, inbounds: [inbound],
|
|
outbounds: [{ tag: directTag, protocol: 'freedom', settings: {} }],
|
|
routingRules: [{ type: 'field', inboundTag: [inbound.tag], outboundTag: directTag }]
|
|
};
|
|
}
|
|
|
|
function buildRelayInbound({ tag, port, protocol, credentials, customer, reality, networkMode, tlsDomain }) {
|
|
const email = `ng:${customer.id}`;
|
|
if (protocol === 'hysteria2') {
|
|
if (!tlsDomain) throw new Error('Hysteria 2 入口缺少有效证书域名');
|
|
return inboundBase(tag, port, 'hysteria', {
|
|
// Xray 26.3.27 reads `clients`; newer cores read `users`.
|
|
// Keep both until all supported cores accept the same spelling.
|
|
version: 2,
|
|
clients: [{ auth: credentials.relayPassword, level: 0, email }],
|
|
users: [{ auth: credentials.relayPassword, level: 0, email }]
|
|
}, {
|
|
// Older Xray reads `network`; newer cores accept `method`.
|
|
network: 'hysteria', method: 'hysteria', security: 'tls', hysteriaSettings: { version: 2 },
|
|
tlsSettings: { serverName: tlsDomain, alpn: ['h3'], certificates: [{
|
|
certificateFile: `/etc/nexusgate/tls/${tlsDomain}/fullchain.pem`,
|
|
keyFile: `/etc/nexusgate/tls/${tlsDomain}/privkey.pem`
|
|
}] }
|
|
}, networkMode);
|
|
}
|
|
if (protocol === 'vless-reality-vision' || protocol === 'vless-reality') {
|
|
const client = { id: credentials.clientId, email };
|
|
if (protocol === 'vless-reality-vision') client.flow = 'xtls-rprx-vision';
|
|
return inboundBase(tag, port, 'vless', { clients: [client], decryption: 'none' }, {
|
|
network: 'raw', security: 'reality',
|
|
realitySettings: {
|
|
show: false, target: `${reality.serverName}:${reality.destPort}`, xver: 0,
|
|
serverNames: [reality.serverName], privateKey: `\${REALITY_PRIVATE:${reality.keyId}}`, shortIds: [credentials.shortId]
|
|
}
|
|
}, networkMode);
|
|
}
|
|
if (SHADOWSOCKS_METHODS[protocol]) return shadowsocksInbound(tag, port, protocol, credentials.relayPassword, networkMode);
|
|
if (protocol === 'socks5-auth') return socksInbound(tag, port, credentials, credentials.relayPassword, networkMode);
|
|
if (protocol === 'vless-ws' || protocol === 'vless-ws-tls') {
|
|
if (protocol === 'vless-ws-tls' && !tlsDomain) throw new Error('TLS 节点缺少有效证书域名');
|
|
return inboundBase(tag, port, 'vless', { clients: [{ id: credentials.clientId, email }], decryption: 'none' }, {
|
|
network: 'ws', security: protocol === 'vless-ws-tls' ? 'tls' : 'none', wsSettings: { path: credentials.wsPath },
|
|
...(protocol === 'vless-ws-tls' ? { tlsSettings: { serverName: tlsDomain,
|
|
certificates: [{ certificateFile: `/etc/nexusgate/tls/${tlsDomain}/fullchain.pem`, keyFile: `/etc/nexusgate/tls/${tlsDomain}/privkey.pem` }] } } : {})
|
|
}, networkMode);
|
|
}
|
|
if (protocol === 'vmess-ws') {
|
|
return inboundBase(tag, port, 'vmess', { clients: [{ id: credentials.clientId, email }] }, {
|
|
network: 'ws', security: 'none', wsSettings: { path: credentials.wsPath }
|
|
}, networkMode);
|
|
}
|
|
throw new Error(`Unsupported relay ingress: ${protocol}`);
|
|
}
|
|
|
|
function serverAddress(server, networkMode) {
|
|
return networkMode === 'ipv6' && server.publicAddressV6 ? server.publicAddressV6 : server.publicAddress;
|
|
}
|
|
|
|
function buildExitOutbound(tag, protocol, exitServer, exitPort, credentials, networkMode) {
|
|
const address = serverAddress(exitServer, networkMode);
|
|
const cipher = SHADOWSOCKS_METHODS[protocol];
|
|
if (cipher) return { tag, protocol: 'shadowsocks', settings: { servers: [{ address, port: exitPort, method: cipher.method, password: credentials.exitPassword }] } };
|
|
if (protocol === 'socks5-auth') return { tag, protocol: 'socks', settings: { servers: [{ address, port: exitPort, users: [{ user: credentials.socksUser, pass: credentials.exitPassword }] }] } };
|
|
if (protocol === 'vless-tcp') {
|
|
return {
|
|
tag, protocol: 'vless', settings: { vnext: [{ address, port: exitPort, users: [{ id: credentials.clientId, encryption: 'none' }] }] },
|
|
streamSettings: { network: 'raw', security: 'none' }
|
|
};
|
|
}
|
|
throw new Error(`Unsupported exit transport: ${protocol}`);
|
|
}
|
|
|
|
function singBoxOutbound(tag, protocol, exitServer, exitPort, credentials, networkMode) {
|
|
const base = { tag, server: serverAddress(exitServer, networkMode), server_port: exitPort };
|
|
const cipher = SHADOWSOCKS_METHODS[protocol];
|
|
if (cipher) return { type: 'shadowsocks', ...base, method: cipher.method, password: credentials.exitPassword };
|
|
if (protocol === 'socks5-auth') return { type: 'socks', ...base, version: '5', username: credentials.socksUser, password: credentials.exitPassword };
|
|
if (protocol === 'vless-tcp') return { type: 'vless', ...base, uuid: credentials.clientId };
|
|
throw new Error(`Unsupported exit transport: ${protocol}`);
|
|
}
|
|
|
|
function anytlsResource({ resourceId, tagPrefix, port, credentials, customer, networkMode, tlsDomain, exitProtocol, exitServer, exitPort }) {
|
|
if (!tlsDomain) throw new Error('AnyTLS 入口缺少有效证书域名');
|
|
const tag = `${tagPrefix}-in`;
|
|
const outboundTag = `${tagPrefix}-${exitServer ? 'exit' : 'direct'}`;
|
|
return {
|
|
id: resourceId, engine: 'sing-box',
|
|
meta: { kind: exitServer ? 'relay' : 'direct', customerId: customer.id, metricsTag: tag, protocol: 'anytls' },
|
|
inbounds: [{ type: 'anytls', tag, listen: listenAddress(networkMode), listen_port: port,
|
|
users: [{ name: `ng:${customer.id}`, password: credentials.relayPassword }],
|
|
tls: { enabled: true, server_name: tlsDomain,
|
|
certificate_path: `/etc/nexusgate/tls/${tlsDomain}/fullchain.pem`,
|
|
key_path: `/etc/nexusgate/tls/${tlsDomain}/privkey.pem` } }],
|
|
outbounds: [exitServer ? singBoxOutbound(outboundTag, exitProtocol, exitServer, exitPort, credentials, networkMode)
|
|
: { type: 'direct', tag: outboundTag }],
|
|
routingRules: [{ inbound: [tag], action: 'route', outbound: outboundTag }]
|
|
};
|
|
}
|
|
|
|
function buildRelayResource({ resourceId, tagPrefix, port, protocol, exitProtocol, exitServer, exitPort, credentials, customer, reality, networkMode, tlsDomain }) {
|
|
if (protocol === 'anytls') return anytlsResource({ resourceId, tagPrefix, port, credentials, customer, networkMode, tlsDomain, exitProtocol, exitServer, exitPort });
|
|
const inbound = buildRelayInbound({ tag: `${tagPrefix}-in`, port, protocol, credentials, customer, reality, networkMode, tlsDomain });
|
|
const outboundTag = `${tagPrefix}-exit`;
|
|
return {
|
|
id: resourceId, meta: { kind: 'relay', customerId: customer.id, metricsTag: inbound.tag, protocol },
|
|
inbounds: [inbound], outbounds: [buildExitOutbound(outboundTag, exitProtocol, exitServer, exitPort, credentials, networkMode)],
|
|
routingRules: [{ type: 'field', inboundTag: [inbound.tag], outboundTag }]
|
|
};
|
|
}
|
|
|
|
function buildDirectResource({ resourceId, tagPrefix, port, protocol, credentials, customer, reality, networkMode, tlsDomain }) {
|
|
if (protocol === 'anytls') return anytlsResource({ resourceId, tagPrefix, port, credentials, customer, networkMode, tlsDomain });
|
|
const inbound = buildRelayInbound({ tag: `${tagPrefix}-in`, port, protocol, credentials, customer, reality, networkMode, tlsDomain });
|
|
const outboundTag = `${tagPrefix}-direct`;
|
|
return {
|
|
id: resourceId, meta: { kind: 'direct', customerId: customer.id, metricsTag: inbound.tag, protocol },
|
|
inbounds: [inbound], outbounds: [{ tag: outboundTag, protocol: 'freedom', settings: {} }],
|
|
routingRules: [{ type: 'field', inboundTag: [inbound.tag], outboundTag }]
|
|
};
|
|
}
|
|
|
|
function uriHost(address) { return net.isIP(String(address)) === 6 ? `[${address}]` : address; }
|
|
|
|
function buildClientUri({ protocol, relayServer, relayPort, credentials, reality, publicKey, name, networkMode, tlsDomain }) {
|
|
const label = encodeURIComponent(name);
|
|
const publicAddress = serverAddress(relayServer, networkMode);
|
|
const host = uriHost(publicAddress);
|
|
if (protocol === 'hysteria2') {
|
|
const query = new URLSearchParams({ sni: tlsDomain, alpn: 'h3' });
|
|
return `hysteria2://${encodeURIComponent(credentials.relayPassword)}@${host}:${relayPort}?${query}#${label}`;
|
|
}
|
|
if (protocol === 'anytls') {
|
|
const query = new URLSearchParams({ sni: tlsDomain });
|
|
return `anytls://${encodeURIComponent(credentials.relayPassword)}@${host}:${relayPort}?${query}#${label}`;
|
|
}
|
|
if (protocol === 'vless-reality-vision' || protocol === 'vless-reality') {
|
|
if (!publicKey) return null;
|
|
const query = new URLSearchParams({ encryption: 'none', security: 'reality', sni: reality.serverName, fp: 'chrome', pbk: publicKey, sid: credentials.shortId, type: 'tcp', headerType: 'none' });
|
|
if (protocol === 'vless-reality-vision') query.set('flow', 'xtls-rprx-vision');
|
|
return `vless://${credentials.clientId}@${host}:${relayPort}?${query}#${label}`;
|
|
}
|
|
if (protocol === 'vless-ws' || protocol === 'vless-ws-tls') {
|
|
const query = new URLSearchParams({ encryption: 'none', security: protocol === 'vless-ws-tls' ? 'tls' : 'none', type: 'ws', path: credentials.wsPath });
|
|
if (protocol === 'vless-ws-tls') query.set('sni', tlsDomain);
|
|
return `vless://${credentials.clientId}@${host}:${relayPort}?${query}#${label}`;
|
|
}
|
|
if (SHADOWSOCKS_METHODS[protocol]) {
|
|
const user = Buffer.from(`${SHADOWSOCKS_METHODS[protocol].method}:${credentials.relayPassword}`).toString('base64url');
|
|
return `ss://${user}@${host}:${relayPort}#${label}`;
|
|
}
|
|
if (protocol === 'socks5-auth') return `socks5://${encodeURIComponent(credentials.socksUser)}:${encodeURIComponent(credentials.relayPassword)}@${host}:${relayPort}#${label}`;
|
|
if (protocol === 'vmess-ws') {
|
|
const payload = { v: '2', ps: name, add: publicAddress, port: String(relayPort), id: credentials.clientId, aid: '0', scy: 'auto', net: 'ws', type: 'none', host: '', path: credentials.wsPath, tls: '' };
|
|
return `vmess://${Buffer.from(JSON.stringify(payload)).toString('base64')}`;
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function profile(role, protocol) { return PROFILE_CATALOG.find((item) => item.role === role && item.id === protocol); }
|
|
function validateEntryProtocol(protocol) {
|
|
const item = profile('relay-ingress', protocol);
|
|
if (!item || !item.deployable) { const error = new Error(`Unsupported relay ingress: ${protocol}`); error.statusCode = 400; throw error; }
|
|
}
|
|
function validateProtocolPair(relayProtocol, exitProtocol) {
|
|
validateEntryProtocol(relayProtocol);
|
|
const exit = profile('exit-transport', exitProtocol);
|
|
if (!exit || !exit.deployable) { const error = new Error(`Unsupported exit transport: ${exitProtocol}`); error.statusCode = 400; throw error; }
|
|
}
|
|
function isRealityProtocol(protocol) { return ['vless-reality-vision', 'vless-reality'].includes(protocol); }
|
|
|
|
module.exports = {
|
|
PROFILE_CATALOG, REALITY_PRESETS, SHADOWSOCKS_METHODS, newCredentialSet, buildExitResource,
|
|
buildRelayResource, buildDirectResource, buildClientUri, validateEntryProtocol, validateProtocolPair, isRealityProtocol
|
|
};
|